Do I need a data processing agreement (DPA)?

One question, three instruments

“Do we need a DPA?” collapses three different instruments into one word. The GDPR uses different tools for different relationships, and picking the wrong one is worse than picking none: it documents a relationship that does not exist and leaves the real duties unassigned.

1. A DPA is the Article 28(3) contract for a controller engaging a processor, with the Article 28(4) equivalent contract down any sub-processor chain.
2. An Article 26 arrangement is the transparent allocation of responsibilities for joint controllers, whose essence must be made available to data subjects.
3. No Article 28 instrument applies between independent controllers, though a data-sharing arrangement may still be prudent.

This guide uses provision identifiers, short statutory terms, and original plain-English summaries; it does not reproduce full provisions. It is educational content, not legal advice and not a binding determination. Whether a party is a controller, a processor, or a joint controller is a functional judgement for your organisation and its DPO or counsel.

How to decide, step by step

1. 1

   Check whether personal data is involved at all

   “Do I need a DPA?” is not the first question. The first question is whether the arrangement involves personal data at all, in the sense of Article 4(1): information relating to an identified or identifiable living person. Article 28 governs processing carried out on behalf of a controller; where no personal data is processed, that machinery does not engage and no DPA is required on that basis. Be careful with the edge cases before you conclude the rule is off: usage logs, IP addresses, device identifiers, and support attachments routinely carry personal data even when the service is described as infrastructure. If you cannot say what data flows through the arrangement, map it first, then continue.

2. 2

   Determine the roles functionally, not by what the contract says

   The decisive question is who determines the purposes and means of the processing. EDPB Guidelines 07/2020 (adopted 7 July 2021, version 2.1 with minor corrections, 20 September 2022) apply a functional, fact-based test: a controller decides why and how personal data is processed; a processor acts on a controller's behalf and follows its documented instructions; joint controllers jointly determine the purposes and means. The label a contract uses does not settle the role: under Article 28(10), a party that processes data for its own purposes despite being labelled a processor is a controller for that processing. The Court of Justice applied the functional approach in Fashion ID (Case C-40/17, judgment of 29 July 2019), a case decided under the predecessor 1995 Directive and used by the EDPB guidelines: in the circumstances of that case, the operator of a website embedding a social plug-in was held jointly responsible, with the platform, for the collection and transmission stages, while later processing the operator did not determine stayed with the platform. Practical tells: who decided the data uses in the deal, who sets retention periods and recipient categories, and who can change the processing without asking the other party.

3. 3

   Jointly determine purposes and means: Article 26, not a DPA

   If the parties jointly determine the purposes and means, they are joint controllers, and the required instrument is the transparent arrangement of Article 26, not an Article 28 DPA. The arrangement must set out their respective responsibilities for compliance, in particular toward data subjects: who answers which rights requests, who provides the Article 13/14 information, and who handles the Article 15 to 21 rights. Its essence must be made available to the data subjects (Article 26(2)), and the allocation does not bind data subjects: irrespective of the terms of the arrangement, they can exercise their rights against each of the controllers (Article 26(3)). A DPA between joint controllers is the wrong instrument: it implies one party acts on the other's behalf, which is not the relationship, and it does not deliver the transparency the article asks for. Two qualifications keep this step honest. Union or Member State law may already determine the respective responsibilities, in which case the arrangement is needed only in so far as it does not (Article 26(1)). And joint controllership is assessed per processing operation: Fashion ID found joint controllership for the collection and transmission stages, not for everything the platform later does. If one of the parties later starts acting on the other's instructions only, the instrument has to change, not just the wording.

4. 4

   One party processes on the other's behalf: the Article 28(3) DPA

   If the relationship is controller and processor, meaning one party processes personal data on behalf of, and on the documented instructions of, the other, then Article 28(3) requires that processing to be governed by a contract or other legal act under Union or Member State law: for a commercial vendor relationship, the data processing agreement, in writing, including electronic form (Article 28(9)). Article 28(1) adds the controller-side duty to use only processors that provide sufficient guarantees of GDPR-compliant processing, which is why vendor due diligence and the DPA are two halves of one obligation, not alternatives. Put the contract in place before the processing starts. What the contract must cover is not open-ended: the article sets out the processing's subject-matter, duration, nature and purposes, the types of personal data and categories of data subjects, and the controller's obligations and rights, followed by the mandatory processor duties summarised below. Two of those duties carry their own precision. The instructions-only duty yields only where Union or Member State law the processor is subject to requires the processing, and that requirement must be notified to the controller before processing unless the law prohibits notification on important public-interest grounds. And the warning duty is not limited to GDPR infringements: the processor must inform the controller immediately if it believes an instruction breaches the GDPR or other Union or Member State data-protection law. A processor is also directly bound by parts of Article 28 and the Article 32 security duties regardless of the contract, so a DPA is not paperwork that only protects the controller. If the “processor” also determines its own purposes for some processing, that operation needs its own role assessment and the relabeling rule of Article 28(10) applies to it; the genuinely instructed processing still needs its DPA. Where the relationship looks partly one way and partly the other, split the operations and assess each.

5. 5

   Each party its own purposes: no Article 28 contract

   If each party independently determines its own purposes, they are separate controllers, and Article 28 does not apply between them: no controller-processor relationship arises, so no DPA is required on that basis. A data-sharing arrangement covering each party's lawful basis, retention, security, and incident cooperation may still be prudent, but it is a different artefact with a different job; renaming it a DPA does not bring Article 28 into play, and having one does not create processor duties that do not exist. Keep the assessment and its reasoning with your records, and re-check when the arrangement changes: the moment one party starts processing on the other's behalf (support, hosting, analytics, delivery), the relationship moves into Article 28 territory and the screen has to run again.

6. 6

   Handle sub-processors, transfers, then record and re-check

   Two refinements sit on top of whatever the relationship requires, and neither changes the relationship branch itself. First, sub-processors: a processor may engage a sub-processor only with the controller's prior specific or general writtenauthorisation (Article 28(2)). Under general authorisation, the processor must inform the controller of any intended addition or replacement of processors, giving the controller the opportunity to object. The processor must impose the same data-protection obligations on each sub-processor by contract (Article 28(4)) and remains fully liable to the controller for the sub-processor's performance. In practice that means an equivalent contract down the chain, not just a list in the appendix. Second, international transfers: if personal data leaves the EU/EEA, Chapter V needs its own mechanism, for example an adequacy decision or standard contractual clauses with a transfer impact assessment where safeguards are needed. The DPA and the transfer mechanism are separate layers: Article 28 compliance alone does not establish transfer compliance. Record the role analysis with your records, and re-run the screen when the arrangement changes, because roles drift: a hosting vendor becomes a processor the moment it stores personal data for you, and a partner may become a joint controller where a shared campaign jointly determines the relevant personal-data processing. Choosing merely technical implementation details, on the other hand, does not by itself make a processor a joint controller.

Six mistakes that produce the wrong instrument

• Assuming every vendor relationship needs a DPA

  The instrument follows the relationship. Two independent controllers do not need an Article 28 contract between them, and joint controllers need an Article 26 arrangement instead. Buying a DPA template and sending it to every counterparty does not fix a misassigned role; it documents the wrong one.

• Letting the contract label settle the roles

  Calling a party a processor does not make it one. Under Article 28(10), a processor that determines its own purposes and means for a processing operation is a controller for that operation, whatever the contract says. EDPB Guidelines 07/2020 read the roles functionally: who decided the purposes, who can change the processing, who bears the instructions. Genuinely instructed processing keeps its DPA; own-purpose processing needs its own assessment.

• Signing a DPA between joint controllers

  Joint controllers need the Article 26 arrangement, with responsibilities allocated transparently and its essence made available to data subjects, who keep their rights against each controller (Article 26(3)). An Article 28 contract implies one party merely follows the other's instructions, and it does not deliver the transparency Article 26 asks for. The wrong instrument leaves real duties unassigned.

• Treating a signed DPA as a transfer mechanism

  Chapter V is its own question. A transfer of personal data outside the EU/EEA needs an adequacy decision or, for example, standard contractual clauses with a transfer impact assessment, regardless of how good the Article 28 contract is. Where the standard clauses apply, the right module can carry both the Article 28 terms and the transfer mechanism in one set; what it can never do is let Article 28 compliance stand in for transfer compliance. Vendors that answer a transfer question with 'we have a DPA' have answered a different question.

• Forgetting the chain

  Article 28(2) and 28(4) apply at every level: the processor needs the controller's written authorisation for each sub-processor (specific, or general with notice of additions and an opportunity to object), must impose the same obligations by contract, and stays fully liable for the sub-processor's performance. A DPA that stops at the first level leaves the rest of the chain undocumented.

• Treating the role analysis as a one-time exercise

  Roles drift. A hosting vendor becomes a processor the day it stores personal data for you; a partner may become a joint controller where a shared campaign jointly determines the relevant personal-data processing; a processor becomes a controller if it starts using your data for its own purposes. Re-run the screen when the arrangement changes, and keep the assessment with your records.

Frequently asked questions